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                        THURSDAY, JULY 10, 2008

                                       U.S. Senate,
                                Committee on the Judiciary,
                                                   Washington, D.C.
    The Committee met, pursuant to notice, at 10:03 a.m., in 
room SD-226, Dirksen Senate Office Building, Hon. Patrick J. 
Leahy, Chairman of the Committee, presiding.
    Present: Senators Leahy, Cardin, and Specter.

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM 
                      THE STATE OF VERMONT

    Chairman Leahy. Good morning. Today, the Committee is going 
to hold an important hearing on the unauthorized access of 
Americans' passport files. Millions of Americans, including, I 
expect, every member of this Committee, entrust their personal 
information to the State Department in order to obtain 
passports and other services. We give a great deal of 
information, but we trust our Government to protect the private 
information of its citizens. But, sadly, the State Department 
has failed to honor this duty. They have left millions of 
ordinary Americans vulnerable to not only privacy violations 
but to identity theft that could come from that and other 
crimes.
    Now, last week--while Americans were celebrating 
Independence Day--the State Department's Acting Inspector 
General issued a report finding that State Department workers 
and contractors repeatedly accessed the passport files of 
entertainers, athletes, and other high-profile Americans 
without proper authorization. Now, I do not care whether it is 
a well-known person or someone we have never heard of. Either 
way it is wrong. And this revelation of passport snooping comes 
after press reports in March that the passport files of three 
Presidential candidates--Senators Obama, Clinton, and McCain--
were improperly accessed. Somebody running for office, as they 
do, give up enough of their privacy as it is. They ought to be 
able to count on their own Government protecting it.
    The Inspector General's findings raise serious concerns 
about possible violations of the Privacy Act and other Federal 
laws. And according to the report, 85 percent of the passport 
records included in a sample of high-profile Americans had been 
searched at least once--and many files were searched multiple 
times--during a 5\1/2\-year period. In fact, one individual's 
passport records were searched 356 different times by 77 
different people.
    The Inspector General's report reveals that the records of 
millions of ordinary Americans are also vulnerable to privacy 
breaches. There are no checks in the system to even determine 
if the passport files of the average American are accessed. 
Now, these files, just so we fully understand, contain name, 
date and place of birth, and Social Security numbers. As some 
of the experts on the Internet and data privacy know these are 
the kinds of facts somebody wants when they want to steal your 
identity. But the State Department does not have a general lack 
of policies, procedures, guidance, and training to stop it. 
According to the report, the Department's Passport Information 
Electronic Records System--PIERS--contains the passport records 
for approximately 127 million passport holders. Now that our 
Government is requiring us to have passports even to go into a 
friendly country, like Canada, the number of passport files to 
protect grows.
    The State Department could not readily identify the 
universe of Government workers and contractors who have access 
to this information. The Inspector General estimates that this 
figure exceeds 20,000 Government employees from various 
agencies and outside contractors. We might as well just post 
this stuff on billboards all over the country. And the tip of 
the iceberg in this report is the fact that passport 
information is shared with other agencies, and we have no idea 
what procedures are followed to protect information once it 
leaves the State Department. So here, sure, take all this 
information, bring it back someday. It has got to be better 
than that. The State Department Inspector General has referred 
this serious matter to the Justice Department. I made it very 
clear to the Attorney General yesterday that I hope the 
Department's Criminal Division will investigate this 
thoroughly. If criminal violations have occurred, people ought 
to go to jail.
    The lax data security at the State Department is not 
unique. A week does not go by without reports of personal data 
privacy breaches at Government agencies and private businesses. 
Just recently, we had front-page headlines with news about the 
theft of sensitive medical information from the National 
Institutes of Health, and earlier reports of data breaches have 
involved virtually every branch of our Federal Government. I 
just cannot imagine this. You might as well just open up the 
files and leave them out on the street corner and say, ``Here, 
help yourself.''
    The Inspector General's report is just the latest example 
of why we should have swift action on the Leahy-Specter 
Personal Data Privacy and Security Act. Senator Specter and I 
put this together. It is a comprehensive privacy bill that 
would help to prevent data security breaches and provide 
further protections in the handling of American's private data. 
And I hope that the Senate will promptly pass it.
    Data privacy and security at our Federal agencies is a 
serious and growing problem. We have to address it. So we have 
to understand not only what went wrong at the State Department 
but elsewhere. And I am glad the Department's Acting Inspector 
General and Assistant Inspector General for Audits are here to 
share their findings. And we have a distinguished panel of 
privacy experts. And then I hope we will end up passing the 
Leahy-Specter bill.
    [The prepared statement of Senator Leahy appears as a 
submission for the record.]
    With that, I will turn to Senator Specter.

STATEMENT OF HON. ARLEN SPECTER, A U.S. SENATOR FROM THE STATE 
                        OF PENNSYLVANIA

    Senator Specter. Thank you. Mr. Chairman, I commend you on 
calling this hearing so promptly. The Inspector General's 
report was issued on July 7th. This is July 10th. That is 
pretty unusual for an oversight committee to move into a field. 
But I think the implications of this matter warrant it.
    On every turn, we find that privacy is in jeopardy. 
Yesterday we enacted followup legislation on the Foreign 
Intelligence Surveillance Act, which goes further than we had 
in the past. And when you deal with national security, there 
are very weighty factors. But where you have snoopers, there is 
absolutely no justification for what they are doing. And, 
regrettably, when you take a look at all of the snoopers, it is 
sort of overwhelming.
    Just last month, sensitive information on about a thousand 
patients at Walter Reed Army Medical Center exposed a security 
breach. Last year, thieves stole a Transportation Security 
Administration computer containing information on some 100,000 
current and former employees. The Department of Agriculture 2 
years ago exposed 26,000 employees, contractors, and retirees 
to an invasion of privacy. Also in 2006, hackers stole data 
from the Defense Department system on 14,000 active-duty and 
retired servicemembers' independents. And the list goes on and 
on. There is obviously a great interest in personalities and 
high-profile people, but we have to do something very forceful 
to stop it.
    I was intrigued by one of the statistics in the IG's 
report, Inspector General's report, that the records of one 
individual were accessed a total of 356 times by 77 users 
between 2002 and 2008. I would like to know who that was. Maybe 
I would be interested in that myself.
    [Laughter.]
    Senator Specter. There must be something very fascinating, 
perhaps even lurid, about that particular individual.
    But one of the great values in our society is privacy, and 
vigilance is the cost of being effective at protecting it. So I 
am glad to see our Committee moving ahead, Mr. Chairman, and I 
am glad to cooperate with you in expediting this important 
hearing.
    Chairman Leahy. Well, it would be impossible to move 
forward on this without you, and you have been so good on the 
privacy bill. You know, in Vermont, we tend to respect our 
privacy a great deal, and I will put this story in perspective. 
I live on a dirt road, an old 1850s farmhouse we have had for 
over 50 years, a lot of land, fields, and whatnot. And 
adjoining farmers hayed the fields and so on since I was a 
teenager. And this was a story in the New York Times. It is the 
only thing I think was ever written about me that I have 
actually saved, even framed, and it goes almost this way.
    It was a Saturday morning. A little farmer was standing on 
the porch. A reporter in an out-of-State car pulls up and says, 
``Does Senator Leahy live up this road?'' He said, ``Are you a 
relative of his?'' He said, ``No. No, I am not.'' He said, 
``Well, are you a friend of his?'' ``Well, not really.'' ``Is 
he expecting you?'' ``No.'' ``Never heard of him.''
    [Laughter.]
    Chairman Leahy. So we love our privacy.
    Senator Specter. Well, Senator Leahy, as I understand it, 
the ``fahrm''--also know as the ``farm''--is expansive enough 
so that you can hide.
    Chairman Leahy. That it is.
    We are fortunate this morning. Our first witness is 
Ambassador Harold Geisel. Ambassador Geisel currently serves as 
the Acting Inspector General for the Department of State. He 
assumed the duties of Deputy Inspector General for the 
Department of State and the Broadcasting Board of Governors in 
June of this year. He is a career Department of State foreign 
service officer. He has dedicated more than 20 years to the 
Department. In 1994, Ambassador Geisel was assigned as Acting 
Inspector General of the State Department. He help the position 
of Deputy Assistant Secretary of State for Information 
Management from 1995 to 1996, during which he directed the 
development of the Department's first IT strategy plan. He 
served as our Ambassador to Mauritius in 1996 to 1999, received 
his bachelor's degree in liberal arts from Johns Hopkins 
University and his master's degree in finance from the 
University of Virginia. And I saw Senator Cardin of Maryland 
smile when I mentioned Johns Hopkins.
    Please go ahead, Ambassador.

  STATEMENT OF AMBASSADOR HAROLD W. GEISEL, ACTING INSPECTOR 
         GENERAL, DEPARTMENT OF STATE, WASHINGTON, D.C.

    Ambassador Geisel. Chairman Leahy, Ranking Member Specter, 
Senator Cardin, thank you for inviting me to discuss with you 
the privacy concerns reported in the results of our review of 
controls over access to passport records in the Department of 
State's Passport Information Electronic Records System, or 
PIERS. The full report has been provided to the Committee.
    In March 2008, media reports surfaced that the passport 
files maintained by the Department of State of three U.S. 
Senators, who were also Presidential candidates, had been 
improperly accessed by Department employees and contractors. On 
March 21, 2008, the Office of Inspector General, Office of 
Audits, initiated a review of Bureau of Consular Affairs 
controls over access to passport records and issued the final 
report 1 week ago, on July 2nd. The OIG made 22 recommendations 
to address the control weaknesses, and the Department concurred 
with 19 of them, partially agreed with one, and did not agree 
with two recommendations.
    OIG found many control weaknesses--including a general lack 
of policies, procedures, guidance, and training--relating to 
the prevention and detection of unauthorized access to passport 
and applicant information and the subsequent response and 
disciplinary processes when a potential unauthorized access is 
substantiated.
    As of April 2008, PIERS contained records on about 192 
million passports for about 127 million passport holders. These 
records include personally identifiable information, or PII, as 
it is known, such as the applicant's name, gender, Social 
Security number, date and place of birth, and passport number. 
PIERS also contains additional information, such as previous 
names used by the applicant, citizenship status of the 
applicant's parents or spouse, and scanned images of passport 
photos. PIERS offers users the ability to query information 
pertaining to passports and vital records, as well as to view 
and print original copies of the associated documents. As a 
result, PIERS records are protected from release by the Privacy 
Act of 1974. Unauthorized access to PIERS records may also 
constitute a violation of the Computer Fraud and Abuse Act.
    At the time of the publicized breaches, neither Consular 
Affairs nor the Department had implemented breach notification 
policies, procedures, or other criteria for reporting incidents 
of unauthorized access of passport records when they were 
detected. However, between March and May 2008, Consular Affairs 
and the Bureau of Administration took a number of corrective 
actions, including issuing interim guidance on the various 
steps to be followed and decisions to be made in response to a 
potential incident of unauthorized access to passport records 
and applicant personally identifiable information, and they 
issued a Department-wide PII breach response policy.
    While these immediate actions taken are commendable, OIG 
has recommended that the Department conduct the necessary 
vulnerability and risk assessments of all passport systems 
given the weaknesses and data vulnerabilities identified in 
this review of PIERS. Accordingly, OIG believes that the 
Department should make resources available to conduct the 
assessments as quickly as possible.
    OIG also recommended that CA ensure the accuracy of its 
Privacy Impact Assessments for PIERS and for all other passport 
systems to accurately reflect security controls for and risks 
to personally identifiable information.
    I would like to introduce Mr. Mark W. Duda, Assistant 
Inspector General for Audits, who led this review, and he will 
provide a summary of the findings.
    Thank you for the opportunity to present this timely 
information to you today. Following Mr. Duda's remarks, we 
would be happy to answer any questions you may have.
    [The prepared statement of Ambassador Geisel appears as a 
submission for the record.]
    Chairman Leahy. Thank you, Ambassador. And, of course, Mr. 
Duda, prior to being at the Department of State, was senior 
evaluator in the Department of Treasury Office of Inspector 
General, as well as auditor in charge at the Smithsonian 
Institution's Office of Inspector General. And, Senator Cardin, 
you will be interested in known he received a bachelor of 
science degree in accounting from the University of Maryland 
and a master of business administration from the University of 
Baltimore.
    Senator Cardin. I am glad to see that we are getting the 
best talent in the Nation working for us.
    [Laughter.]
    Chairman Leahy. Mr. Duda, why don't you go ahead, and then 
we will start with the questions.

  STATEMENT OF MARK W. DUDA, ASSISTANT INSPECTOR GENERAL FOR 
         AUDITS, DEPARTMENT OF STATE, WASHINGTON, D.C.

    Mr. Duda. Chairman Leahy, Ranking Member Specter, members 
of the Committee, thank you for the opportunity to discuss the 
results of our review of controls over access to passport 
records in the Department of State's Passport Information 
Electronic Records System, which is also known as PIERS. I will 
be referring to that acronym periodically.
    On March 21, 2008, following the first reported breach of a 
Presidential candidate's passport records and at the direction 
of the former Acting Inspector General, the Office of Inspector 
General, Office of Audits, initiated this review of the Bureau 
of Consular Affairs controls over access to passport records in 
PIERS. Specifically, this review focused on determining whether 
the Department: one, adequately protects passport records and 
data contained in PIERS from unauthorized access; and, two, 
responds effectively when incidents of unauthorized access do 
occur.
    During fiscal year 2007, the Department issued about 18.4 
million passports domestically and participated or assisted in 
the issuance of about 365,000 passports overseas.
    According to Consular Affairs officials, there were about 
20,500 users with active PIERS accounts as of May 2008, and 
about 12,200 of these users were employees or contractors of 
the Department. PIERS is also accessed by users at other 
Federal departments and agencies, including the Department of 
Homeland Security, the Federal Bureau of Investigation, and the 
Office of Personnel Management, to assist in conducting 
investigations, security assessments, and analyses.
    In our review, OIG found many control weaknesses--including 
a general lack of policies, procedures, guidance, and 
training--relating to the prevention and detection of 
unauthorized access to passport and applicant information and 
the subsequent response and disciplinary processes when a 
potential unauthorized access is substantiated.
    In some cases, Department officials stated that the lack of 
resources contributed to the lack of controls and to the 
Department's ability to assess vulnerabilities and risk. OIG 
described some security and management practices utilized by 
both the Internal Revenue Service and the Social Security 
Administration as examples where similar improvements could be 
made by the Department.
    OIG made 22 recommendations to address the control 
weaknesses found with safeguarding passport records. We did not 
verify instances of unauthorized access, but we did conduct a 
judgmentally determined study to identify the frequency with 
which the records for 150 high-profile individuals were 
accessed in PIERS between September 2002 and March 2008. Our 
results revealed several patterns that raised serious concerns 
about the potential for undetected unauthorized access to 
passport records. Of the 150 names included in the study, OIG 
found that the records of 127 individuals, or 85 percent, had 
been accessed at least one time. The results showed a total of 
4,148 hits to the passport information for these 150 
individuals. OIG made no determination as to whether the hits 
represented authorized or unauthorized access. Additionally, 
although an 85-percent hit rate appears to be excessive, the 
Department currently lacks any criteria to determine whether 
this is an unusually high rate.
    As stated by the Acting Inspector General, following the 
publicized passport record breaches, the Department implemented 
a number of corrective actions and has other efforts planned, 
as we have detailed in the report.
    Based on the responses from Department officials, of the 22 
recommendations made the Department has agreed with 19 of those 
recommendations; they partially agree with one recommendation; 
and they disagreed with two recommendations. To ensure adequate 
and timely action, OIG will conduct a full compliance followup 
review of the Department's implementation of the 
recommendations in this report, as well as Consular Affairs' 
process for reviewing possible unauthorized accesses by users 
as identified in our study.
    Thank you for the opportunity to appear before you today. I 
would be happy to answer any questions you have.
    [The prepared statement of Mr. Duda appears as a submission 
for the record.]
    Chairman Leahy. Well, thank you. As I sort of indicated 
before, I will start with you, Ambassador. I know the State 
Department has placed a number of celebrities on a special 
watchlist, and dignitaries watch out for that. I am just as 
concerned by the person we do not know the name of who lives 
down the street, works in a store, or whatever else, because 
they have also given all this information up. And it is one 
thing with a watchlist. They are not on that watchlist. Isn't 
it virtually impossible to know if the passport files of 
ordinary American citizens have been improperly accessed?
    Ambassador Geisel. Senator, that is really the key 
question. The answer is we have the ability to know if they 
have been accessed. We do not at this time know if they have--
whether the access is authorized or unauthorized, and a crucial 
part of our recommendations is that we have to know that.
    Chairman Leahy. Yes, because it is one thing to go and look 
back and say, OK, pick out passport number 2936000 or whatever 
and find that. But I am thinking of--for example, if somebody 
wants to--well, I will check on my neighbor or my former 
boyfriend or girlfriend, or somebody may have a more nefarious 
thing, I want to get this information, I know where this person 
lives, they are fairly wealthy, I want to get this information 
and sell it to somebody who will probably pay a lot of money 
for it because they are going to use it to clean out their bank 
account. I mean, there is nothing to ring alarm bells when that 
happens. Is that correct?
    Ambassador Geisel. As it stands right now, Senator, that is 
absolutely correct, and that is why I think one of our most 
important recommendations is that the Department take a look at 
software that does work, such as is used currently by the 
Internal Revenue Service or the Social Security Administration.
    Chairman Leahy. And we know in the past that the Internal 
Revenue Service had a problem with this. People were looking at 
the tax returns of movie actors and all, and usually it was 
just because it is kind of fun to find out. But if they can do 
that, they can also get the person who runs the local grocery 
store.
    Mr. Duda, the State Department has brought in a lot of 
contractors for this surge capacity in processing passport 
applications, especially when it decided that our neighbor to 
the north, Canada, the most friendly country we have ever been 
involved with, poses such a threat that we have all got to 
start having passports to go there. That is a political comment 
to the aside only because I think the policy is ridiculous. But 
as a result, a lot of outside people were hired.
    Is there a greater vulnerability to snooping if you are 
using outside contractors because you do not have the kind of 
leverage that you might have in the State Department? If you 
find a State Department employee doing it, they can be 
disciplined. They can be fired. They can be whatever else. But 
is there greater concern because we have had to rely so much on 
outside contractors?
    Mr. Duda. There could be, but there are actually controls 
you can put in place. Obviously, if the Department is 
soliciting the services of a contractor, they are entering into 
a contract with a vendor, you know, the Department is paying 
the vendor. The Department writes the contracts. The Department 
can put whatever, you know, is legally feasible into a 
contract. And one of the things that can be put in the 
contracts is adequate controls to ensure that contractors have 
access to this data.
    Chairman Leahy. Has that been done?
    Mr. Duda. Partially.
    Chairman Leahy. Partially. And shouldn't we make sure that 
if we are going to have penalties, criminal or otherwise, that 
they be the same whether you are somebody in the State 
Department or somebody in a private contractor?
    Mr. Duda. Absolutely.
    Chairman Leahy. Thank you. And in that regard, Ambassador, 
the Attorney General suggested that DOJ will open a criminal 
investigation into the passport breaches involving the three 
Presidential candidates based upon the referral from your 
office. Are there going to be more referrals from your office?
    Ambassador Geisel. We don't comment on investigations, but 
there will certainly be referrals where we feel that a case can 
be made to the Justice Department and that the Justice 
Department has reasonable probability of achieving a good 
prosecution.
    Chairman Leahy. Both Senator Specter and I are former 
prosecutors, as are a number of the people on this Committee, 
and, frankly, in this kind of thing, I think some well-placed 
prosecutions with the use of the criminal code may be as much 
of a deterrent as you can imagine.
    Senator Specter?
    Senator Specter. Thank you, Mr. Chairman.
    Has anybody been caught?
    Ambassador Geisel. Yes, sir. Those were the referrals that 
were made.
    Senator Specter. And what happened as a result of their 
being identified, apprehended, and caught?
    Ambassador Geisel. Excuse me, sir.
    [Pause.]
    Ambassador Geisel. If these people have actually been 
referred to Justice, I--
    Senator Specter. No, I don't want to know ``ifs.'' I want 
to know if you have apprehended people and they have been 
caught. That is what I want to know.
    Ambassador Geisel. The answer is yes, sir.
    Senator Specter. And how many?
    Ambassador Geisel. Five so far, but it is very much of an 
ongoing investigation, and I am sure--
    Senator Specter. Only five.
    Ambassador Geisel. So far.
    Senator Specter. And have there been prosecutions against 
those individuals?
    Ambassador Geisel. I am not aware of what Justice is doing 
with those referrals.
    Senator Specter. Well, Ambassador, you ought to be. You 
ought to followup as to what the Department of Justice is 
doing. We would like to know that.
    Let me talk to the witness, if I may. I only have 5 
minutes. What is the motivation behind this, if you know? Is it 
just curiosity? Is it just snooping? Why so many invasions of 
privacy here?
    Ambassador Geisel. Well, I hope it is just snooping. I 
suspect--
    Senator Specter. No, no. I don't want to know what you 
hope. What evidence do you have as to what motivates people to 
do this?
    Ambassador Geisel. I don't think we know yet what motivated 
these particular people to snoop.
    Senator Specter. Well, have they been questioned? 
Obviously, they have been. What has the interrogation of these 
people disclosed?
    Ambassador Geisel. So far it is snooping, sir.
    Senator Specter. So far what?
    Ambassador Geisel. It is snooping, just as you said. It is 
snooping. It is peeping. We don't have any evidence that the--
which is what I worry about, that someone would do this, for 
instance, for the purpose of perpetrating identity fraud.
    Senator Specter. Well, is the Department of State making a 
real effort to push prosecutions? Prosecutor Leahy might say to 
you that if you get a conviction, you deter some people from 
doing it. I certainly would say that.
    Ambassador Geisel. Amen, Senator. I cannot think of a 
better way--I think there are two--
    Senator Specter. So what have you done to pursue 
prosecutions to try to have some deterrence?
    Ambassador Geisel. We have referred them to the Justice 
Department.
    Senator Specter. Have you followed up? We write lots of 
letters to the Department of Justice. Senator Leahy had a whole 
portfolio of them yesterday talking to the Attorney General. 
There has to be followup. This is a primary responsibility of 
the Department of State, and the Department of State ought to 
pursue it.
    Ambassador Geisel. I absolutely agree with you, Senator.
    Senator Specter. Well, what do you plan to do about it?
    Ambassador Geisel. I think the best answer is that we, A, 
intend to followup but, B, intend to put in a much better 
system or recommend--
    Senator Specter. Well, a better system we have talked 
about, but where you have the specific cases, would you give a 
report to the Committee within 30 days on the issue of followup 
and what has happened?
    Ambassador Geisel. Absolutely, sir.
    Senator Specter. I note that the penalty for looking for 
commercial advantage or financial gain is increased to 5 years. 
It is 1 year otherwise. Has there been any showing that any of 
these invasions of privacy were motivated by commercial 
advantage or financial gain?
    Ambassador Geisel. Not yet, sir, but as I said, that is our 
greatest worry.
    Senator Specter. Have you pursued the issue as to whether 
somebody is looking for financial gain?
    Ambassador Geisel. Yes, sir, but as I said, so far it 
appears to be peeping.
    Senator Specter. When you have the evidence of unauthorized 
disclosure, do you go to the individuals whose files have been 
tampered with to see if they have any indication that they have 
been prejudiced in any way by what has happened?
    Ambassador Geisel. That is part of an ongoing 
investigation, and I am sure you understand that I--
    Senator Specter. I understand. I am not asking you about 
specific cases. I am asking about procedures. I am not asking 
you about a specific case.
    Ambassador Geisel. Yes, sir.
    Senator Specter. I would not intrude on that.
    Ambassador Geisel. I understand. I don't know that we 
have--let me ask our people. Have we gone to specific 
individuals?
    The answer is--as you advised, I will not discuss it in 
detail, but the answer is yes, we have done so.
    Senator Specter. The answer is yes to which question?
    Ambassador Geisel. The answer is yes, we have spoken with 
individuals to see if they were affected by the--
    Senator Specter. I am not asking you about any specific 
individuals. Have you found any individuals who have been 
prejudiced aside from--just an invasion of privacy is a 
prejudice all by itself. But beyond that, have they lost 
financially? Have they had anything specific happen as a result 
of the unauthorized disclosure or snooping on their records?
    Ambassador Geisel. We have not--that is a negative, sir. So 
far, no one has advised that they have been adversely affected 
in a financial sense by the snooping.
    Senator Specter. Well, as a final comment--my red light is 
on--I would urge you to get tough about it and to followup.
    Ambassador Geisel. Absolutely.
    Senator Specter. And reports are not sufficient. When 
Congress is providing criminal penalties, you have a real 
hammer, and you ought to be using it. If you would supply in 
writing any recommendations you have for modifications of the 
statute, I think the Committee would appreciate that.
    Thank you very much, Ambassador. Thank you, Mr. Duda.
    Thank you, Mr. Chairman.
    Chairman Leahy. Thank you.
    Senator Cardin?
    Senator Cardin. Thank you, Mr. Chairman. I certainly agree 
with your comments and Senator Specter's comments, and I want 
to followup on Senator Specter's points.
    First of all, I want to thank both of you for what you are 
doing in helping us to put in the right procedures to make sure 
this never happens again. But I just want to underscore the 
point that Senator Specter has made. When we had similar 
problems in other agencies--I think about laptops that were 
taken out of offices and that contained sensitive data that 
went missing--we were not clear as to what was being done with 
that sensitive information, which included Social Security 
numbers. We know that identity theft is one of the largest 
criminal problems we have in our community today. We know that 
the information contained in passport files would be very 
valuable for people who want to participate in identity theft. 
As Senator Leahy has said, we know that the information could 
be valuable for criminals who want information about potential 
targets. So the vulnerability is there with the information, 
and that is why it is particularly sensitive.
    I think your testimony has raised a lot more questions than 
we have the answers to. Obviously, someone who does this for 
curiosity to peep in someone else's records is wrong and needs 
to be disciplined. But if they are doing it for financial 
reward, if it is part of criminal activities, then that is a 
much more serious issue, and we want to know about that also.
    I also believe--and I know there is a large volume of 
people whose records have been unauthorized access. But I think 
to a certain degree those individuals are entitled to know 
that. And although in a criminal investigation you may be 
looking at a specific number of cases in order to get the 
cooperation of the individuals whose records were unauthorized 
accessed, but I do think if someone looked at my passport 
records, I have a right to know that.
    So are any steps being taken in order to notify the 
individuals whose records were unauthorized accessed so that 
they are on record, first, that that was done and, second, to 
be alerted to potentially being a victim to other types of 
activities such as identity theft?
    Ambassador Geisel. To date, Senator, the work that we have 
done, we are not yet at the point, as Mr. Duda explained, that 
we are certain that the access was unauthorized, although 
obviously when you are talking about numerous breaches, it 
seems a sure shot.
    The problem will be--well, we cannot notify anyone until we 
know that the access was unauthorized. In many cases, it would 
have been authorized. For example, someone who often crosses 
the border, the Homeland Security person will have a very good 
reason for going back to that file. But we have a lot more work 
to do.
    Mr. Duda. One of the things I wanted to point out is that, 
you know, management's responsibility is obviously to have a 
system in place, have the controls to prevent unauthorized 
access to, you know, PII information for all Americans. OIG's 
role obviously is to oversee that and do testing and so forth.
    In this review that we did, we identified such a large 
number of potential unauthorized accesses and a control 
environment that was limited, at best. We made significant 
recommendations which the Department largely agree with and is 
in the process of implementing. And one of the things they are 
doing right now, they have told us--CIA officials have told us 
that they are looking into all of the potential unauthorized 
accesses from our case study, and then once the determination 
that the Department makes, they will then make referrals to the 
Office of Inspector General.
    Senator Cardin. Let me make a recommendation. To the extent 
that you determine that someone's passport records were 
accessed, unauthorized, will you recommend that that individual 
be notified that his or her records were inappropriately 
accessed?
    Mr. Duda. Yes, absolutely. I don't know whether that will 
be a management responsibility, but OIG definitely--
    Senator Cardin. Will you let us know whether that 
recommendation is followed by the agency so that we know 
whether, in fact, those who were victimized are at least aware 
that they were victimized?
    Mr. Duda. Yes. One of the corrective actions the Department 
has already implemented is drafting a breach response policy, 
and I don't recall the exact specifics, but--
    Senator Cardin. I just want to make sure that we know 
whether the victims, those whose records were accessed 
inappropriately, will be notified, and whether you will be able 
to follow up to let us know whether that, in fact, was carried 
out by the agency.
    Ambassador Geisel. We will make that recommendation, 
Senator.
    Senator Cardin. I appreciate it.
    The second point, Mr. Chairman, just very quickly, we just 
finished acting on the FISA statute, and it just raises a 
question to me as to whether agencies are accessing passport 
records for mass data collections. Is any of this involved in a 
data collection system where there is routine information 
gathered on our passport records as part of homeland security 
or intelligence operations that you are aware of?
    Mr. Duda. Not that I am aware of, but one of our concerns 
in this review or any potential plans of sharing the data in 
PIERS or any of the other passport systems with other agencies 
for any purpose, we want to make sure that there are adequate 
controls in place.
    Senator Cardin. Will you also report back to us if your 
review shows that there is mass data collections from the 
passport records that are questionable from the point of view 
of whether they are authorized by statute?
    Mr. Duda. Absolutely.
    Senator Cardin. Thank you.
    Thank you, Mr. Chairman.
    Chairman Leahy. Thank you very much, and if we have other 
questions, we will submit them for the record. There is going 
to be a roll call vote fairly soon, so if we seem to be 
speeding along, that is why. But thank you both very, very 
much. It helps us highlight the concern that we have here.
    The next panel, if we could arrange to bring them up. This 
panel of people are certainly known to this Committee. Marc 
Rotenberg is the Executive Director of the Electronic Privacy 
Information Center, EPIC, in Washington, D.C. He teaches 
information privacy law at Georgetown University Law Center, an 
excellent school, having graduated from there. He has testified 
before Congress on such topics as encryption policy, consumer 
protection, computer security, communications privacy. He 
chairs the ABA Committee on Privacy and Information Protection. 
He has served on several national and international advisory 
panels, including expert panels in cryptography policy and 
computer security for the OECD, legal experts in cyber space 
law for UNESCO. He is a founding board member and former chair 
of the Public Interest Registry, which manages the .org domain. 
He also served as counsel, in full disclosure, an invaluable 
member of my staff on the Senate Judiciary Committee. He is a 
graduate of Harvard and Stanford Law School, the recipient of 
more awards than I could even name, but that includes the World 
Technology Award in Law.
    Mr. Rotenberg, please go ahead.

  STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC 
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    Mr. Rotenberg. Thank you very much, Mr. Chairman, Senator 
Cardin. I appreciate the opportunity to be here today.
    We have a particular interest in the privacy of personal 
information collected by Federal agencies, and as the recent 
news stories and the report from the Inspector General have 
made clear, the passport information that we are required to 
provide to the Government is not adequately protected. And we 
are particularly concerned about this because there are growing 
demands on personal information by the Federal Government, and 
with the increasing use of identification documents.
    So it is not simply the passport information of 
Presidential candidates or celebrities that is at issue. It is 
the personal information of people who apply for a driver's 
license, work in the Federal Government, or travel to Canada. 
And for these reasons, we think that more needs to be done to 
protect personal privacy, not only at the State Department but 
also across the Federal Government.
    Now, I think it is helpful to understand the background of 
the particular incident at the State Department to put in 
context what the Inspector General uncovered. It was back in 
1992 when State Department officials were found to be going 
through the passport files of then Presidential candidate Bill 
Clinton to try to find embarrassing information. And there was 
an investigation. The State Department subsequently dismissed 
employees who were engaging in this activity. This is precisely 
the concern about information that individuals provide to the 
Federal Government that will be misused, that will obtained by 
identity thieves, or that will be used in ways that are simply 
not appropriate.
    So it was because of that 1992 incident that alarm bells 
literally went off this spring at the State Department when it 
was determined that the passport files of Senators Obama, 
McCain, and Clinton had been improperly accessed. And I think 
it is worth noting that all three Senators made statements at 
the time about the importance of protecting the privacy of 
personal information. In fact, Senator Obama himself said, 
``One of the things that the American people count on in their 
interactions with any level of government is that if they have 
to disclose personal information, that it stay personal and 
stay private.''
    Now, the Inspector General's report, which was undertaken 
pursuant to the March release of the passport information, 
provides some useful information and some useful 
recommendations. But I should point out that much of the report 
has been redacted, that is to say, of the 22 recommendations 
contained in the IG's report, only six, in fact, are available 
for public review. There are many sections of the report that 
have literally been blacked out. If I may show the Committee, 
we have a few pages here from the report.
    [Displays documents.]
    This is a page labeled ``Sensitive but unclassified.'' The 
top half of the page references the FOIA exemption (b)(2) as 
the basis for withholding the information. The bottom does not 
even bother with the (b)(2) designation. It just blacks out the 
entire section of the report. This is problematic because, of 
course, to evaluate the adequacy of the recommendations made by 
the Inspector General, it is important to see the whole report.
    Now, we have made--and it is included in my complete 
statement--a series of recommendations. We do think there 
should be auditing so that whenever there is access, those 
access events will be recorded. We do think there should be 
improved oversight. We think there needs to be some independent 
evaluation of the privacy safeguards within the Federal 
agencies, including the State Department. But I think most 
importantly, the legislation S. 495, which you, Mr. Chairman, 
cosponsored along with Senator Specter and was favorably 
reported by this Committee, contains several very important 
provisions that, if in force, might have actually prevented 
this from occurring, because a big problem today at the State 
Department is that a lot of the information processing is being 
done by private contractors. The agency turns over to a private 
company the responsibility for producing the passports, for 
collecting the information for the passports, for inspecting 
the information. And it is in that process of outsourcing the 
Government function that the privacy concern arises. And so 
this legislation, S. 495, actually puts in place disciplinary 
requirements so that if these kinds of problems occur, people 
can be held accountable, opportunities to review the contractor 
relationship so that an agency can make a determination if the 
contractor is doing enough to protect personal privacy.
    One of the remarkable facts here is that just a few days 
before the State Department revealed that three Presidential 
candidates had their passport files improperly accessed, the 
agency had renewed its contract with Stanley, the privacy 
company, a 5-year deal for $570 million. I think if a company 
cannot protect the personal information of American citizens 
that it obtains, the agencies need to rethink some of those 
contracts.
    So thank you very much for the opportunity. I would be 
pleased to answer your questions.
    [The prepared statement of Mr. Rotenberg appears as a 
submission for the record.]
    Chairman Leahy. Thank you very, very much.
    Ari Schwartz is the Vice President and Chief Operating 
Officer of the Center for Democracy and Technology, CDT. He 
works to promote privacy protection in the Digital Age while 
expanding access to Government information through the 
Internet. He is the leader of the Anti-Spyware Coalition, in 
2006 was awarded the RSA Award for Excellence in Public Policy 
for his work in building the Anti-Spyware Coalition and other 
efforts against spyware. He has been named to the top five 
Influential IT Security Thinkers of 2007 by Secure Computing 
magazine, served as a member of the Department of Commerce 
National Institute of Standards and Technology Information, 
among others.
    So, Mr. Schwartz, I am delighted you are here because I am 
a bit of a bug or nag in my office on keeping spyware off our 
computers.
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    Mr. Schwartz. Thank you very much, Senator Leahy, and 
Senator Cardin as well. Thank you for holding this important 
public hearing and for inviting me to participate.
    I would especially like to commend you, Mr. Chairman, on 
how you opened this hearing. While the news reporting on the 
subject of passport breach has focused on whether Presidential 
candidates or other celebrities had their passport records 
snooped through, the privacy and security of the passport 
records of average individuals has received considerably less 
attention, and you raised that in your opening statement and I 
appreciate that.
    As we heard earlier, there seems to be little to no 
protection on how to prevent or detect the truly nefarious 
activities which passport records such as stalking or identity 
theft that we could see with this kind of browsing.
    To address this problem, CDT suggests that Congress take 
the same approach that it did 11 years ago when it was found 
that IRS employees were browsing tax records. Congress should 
increase oversight and civil and criminal penalties on passport 
records. Just to send you to the right place, that is the 
Taxpayer Browsing Protection Act of 1997 that I know the 
Chairman and many other people on this Committee worked on.
    The illegal browsing of passport records of Americans by 
Government employees should be a major concern not only to the 
millions of passport holders but to all Americans as it 
suggests an inability of Government to protect privacy at the 
highest levels.
    The Inspector General's report pointed to many flaws in the 
State Department's ability to protect privacy. CDT has raised 
many of these same concerns over the past 3 years with the 
State Department. For example, the Inspector General found that 
the Privacy Impact Assessment for the passport data base was 
just inaccurate. CDT wrote to Secretary Rice over a year ago to 
raise concerns about Privacy Impact Assessments at the State 
Department, and particularly the E-Passport program. We never 
received a reply, and no changes to the PIAs were ever made. 
CDT has since found incomplete and inaccurate information in 
several other Privacy Impact Assessments on the Department of 
State website.
    The State Department must be held accountable for the 
failures of its privacy program and encouraged to provide 
resources and leadership so that it can be ensured that our 
privacy is being protected when held by the State Department.
    To prevent other serious breaches of public trust Congress 
will need to address the roots of the problem by more closely 
monitoring the State Department's collection of personal data.
    While the State Department has clearly been a failing 
agency across the board on privacy, there are several other 
failing agencies as well. For example, one agency that CDT 
spoke to told us that a privacy audit revealed that they had 
lost track of half of their Privacy Act system of records. They 
simply do not know where millions of personal records were that 
were originally brought in by this agency. One retiring 
security official from the Department of Interior explained 
publicly, while discussing that agency's constant failures in 
privacy and security reporting, ``We are promiscuous with our 
data. We don't know where our data is.''
    You can call this a privacy concern. You can call this a 
security concern. You can call it a data management concern. 
But to the American taxpayer, it is certainly called a failure.
    CDT agrees with GAO's recent analysis suggesting that the 
way to ensure privacy protection at agencies is through 
improvement in existing Government privacy laws, oversight, and 
leadership. To solve these problems beyond our initial State 
Department specific suggestions, CDT recommends that Congress 
work with the executive branch in the four following areas:
    No. 1, expanding Privacy Act coverage and closing Privacy 
Act loopholes.
    No. 2, improving the quality of Privacy Impact Assessments 
by Government agencies. This would also include Privacy Impact 
Assessments for Government use of commercial data, as required 
in the Leahy-Specter data breach bill, S. 495 as referenced 
earlier.
    No. 3, improving privacy leadership. This would include a 
permanent Chief Privacy Officer position at the Office of 
Management and Budget written into law, Chief Privacy Officers 
at all major component agencies, and the creation of an 
independent Chief Privacy Officer Council with a similar 
structure to the CIO and CFO councils.
    And, No. 4, increasing and improving privacy reporting and 
audits. I detail all these suggestions in my written testimony.
    In general, we believe that there is now consensus around a 
set of sound recommendations for action by Congress and 
executive branch to fill the gaps and loopholes in privacy law 
and policy. CDT urges the Committee and the Senate to work 
quickly so that the next President can have the right tools in 
place upon taking office and can get started immediately on 
strengthening privacy in the Federal Government.
    I look forward to working with you, and we thank you for 
your leadership on these important issues. Thank you for your 
attention, and I look forward to your questions.
    [The prepared statement of Mr. Schwartz appears as a 
submission for the record.]
    Chairman Leahy. Thank you very much.
    Alan Raul is a partner in the Washington, D.C., office of 
the international law firm Sidley Austin. He chairs Sidley's 
Information Law Privacy Practice Group, served as Vice Chairman 
of the White House Privacy and Civil Liberties Oversight Board 
from March 2006 through January 2008. He was the Associate 
Counsel to President Reagan from 1986 to 1988, where he 
represented the White House in connection with the Iran-contra 
investigation. He served as General Counsel to the Office of 
Management and Budget in the Executive Office of the President. 
He was nominated by President George H.W. Bush and confirmed by 
the Senate to the position of General Counsel at the U.S. 
Department of Agriculture from 1989 to 1993. He is a graduate 
of Harvard College, Harvard University's Kennedy School of Law, 
and to show there is no rivalry, the Yale School.
    Please go ahead.
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    Mr. Raul. Thank you, Chairman Leahy, Senator Specter, 
Senator Cardin. Thank you for inviting me to testify on 
protecting the privacy of passport files maintained by the U.S. 
Department of State. It is an honor to appear before you this 
morning.
    I am testifying today in a personal capacity. As you noted, 
I am currently engaged in private law practice in Washington 
where I focus on privacy, data security, and Internet law. And 
until recently, I also served in a part--time capacity as Vice 
Chairman of the White House Privacy and Civil Liberties 
Oversight Board.
    This hearing arises because of a recent investigation and 
report by the State Department's Inspector General indicating 
that the passport files of high-profile individuals, including 
the files of three Presidential candidates--namely, Senators 
McCain, Obama, and Clinton--may have been improperly accessed 
by State Department employees and contractors. The State 
Department announced this week that it had terminated around 
five contractors in connection with what appear to be serious 
violations of personal privacy, Federal law, and internal 
controls.
    While the investigation continues, if the facts turn out to 
be as they now appear, there is no question that the standards 
of the Privacy Act of 1974 were not satisfied. To the extent 
agency employees and contractors accessed passport files with 
no official need to do so, they disrespected the privacy of 
affected passport holders and applicants and brought 
substantial disrepute upon their agency.
    The Privacy Act, the e-Government Act of 2002, and the 
Federal Information Security Management Act of 2002--FISMA--all 
require Government agencies to adopt and implement effective 
controls to prevent just the sort of invasion of personal 
information that occurred here.
    Moreover, each of these Acts authorizes the Director of the 
Office of Management and Budget to assist, guide, and oversee 
Federal efforts in the realm of privacy and information 
security. Congress and the White House should continue to 
support and encourage OMB's leading role in the field of 
privacy and information security.
    With regard to the specific incident at hand, it is not 
clear at this point whether any of the individuals whose files 
were accessed experienced any pecuniary losses or other actual 
damages that would support claims of civil liability under the 
Supreme Court's Doe v. Chao decision of 2004. However, if any 
agency employee or contractor ``willfully disclose[d] the 
material in any manner to any person or agency not entitled to 
receive it,'' or ``knowingly and willfully request[ed] or 
obtain[ed] any record concerning an individual from an agency 
under false pretenses,'' then they would be guilty of a 
criminal misdemeanor and fined up to $5,000.
    It is perfectly clear now, however, that existing law and 
applicable guidance should have prevented State Department 
employees and contractors from engaging in frolics and 
detours--or worse--through the passport files of politicians, 
prominent figures, or indeed, of any Americans. The fact that 
these files were subject to access for no good reason is highly 
troubling. We all expect the Government to do much better in 
safeguarding our personal information.
    Plainly, the State Department must redouble its efforts to 
conduct privacy impact and risk assessments, to communicate 
binding privacy policies to all parties handling personal 
information--both employees and contractors--provide its 
employees and contractors with meaningful privacy and data 
security training so they take these issues seriously, and 
ensure effective audit trails for accessing personal 
information, as well as establishing clear guidelines for 
disciplining and terminating employees and contractors who 
transgress. The State Department should also revisit its 
administrative, technical, and physical safeguards to prevent 
future abuse of passport files and other personal records.
    At the same time, care must be taken to avoid unduly 
restricting proper access to information that is essential for 
national security purposes. As the 9/11 Commission recommended, 
and Congress enacted, the country has a critical need to 
promote an ``information sharing environment'' that transcends 
traditional governmental boundaries in order to help prevent 
future terrorist attacks. But the relevant Government agencies, 
including the State Department, must effectively integrate 
protections for privacy and other civil liberties into this new 
information-sharing environment.
    In any event, if the executive branch wishes to hold the 
private sector, State governments, and foreign nations to high 
standards for information privacy and security, it needs to be 
a consistently good role model for privacy itself. To that end, 
the Government obviously has plenty of room for improvement 
under existing privacy laws and standards for information 
security.
    Thank you for considering my views.
    [The prepared statement of Mr. Raul appears as a submission 
for the record.]
    Chairman Leahy. Thank you. The vote has started. I want to 
ask one question, and then we will recess for a couple minutes 
to see if others are coming back.
    Mr. Rotenberg, last year Senator Specter and I introduced 
our Personal Data Privacy and Security Act. Now, this has a 
specific requirement that the General Services Administration 
has to evaluate the privacy security practices of potential 
Government contractors, but then put penalty provisions in if 
they fail to follow and fail to protect data privacy. Would 
this help?
    Mr. Rotenberg. Absolutely, Senator. As I was thinking about 
the legislation, which I believe you introduced in 2007, it 
occurred to me this was actually an example where the 
legislation was ahead of the problem. In other words, if these 
requirements had been put in place back in 2007, I believe the 
State Department would have been much more careful in its 
relationship with the private contractor, and I think the 
private contractor would have been much more diligent about the 
activities of its employees. And it was the failure to pass 
that legislation earlier that very well may have made possible 
this recent breach.
    So I hope the Senate--and the House, of course--act on 
this. I think it would prevent a lot of damage going forward. 
It is a very sensible approach to a real problem.
    Chairman Leahy. Mr. Schwartz, Mr. Raul, how do you feel 
about that?
    Mr. Schwartz. I strongly agree with that statement. It 
would definitely help privacy and security to have that kind of 
review, and the Government needs to ensure that their security 
efforts and the security efforts of their contractors are the 
best that there are. And I would actually take it a step 
further and say that the entire title of that bill, S. 495, 
Title 4, would have helped in this case. It has better auditing 
capability in that section, assuming that was not done in this 
case, and improvement of Privacy Impact Assessments, something 
that the Inspector General specifically pointed out in this 
case was a failure.
    Chairman Leahy. Mr. Raul?
    Mr. Raul. Chairman Leahy, due diligence of potential 
contractors with regard to their information security systems 
and processes is essential. I think that is recognized in other 
legislation like Gramm-Leach-Bliley, HIPAA, regulations under 
those statutes. I think there is existing guidance that Federal 
agencies should be doing it now.
    I think the message really need to be effectively 
communicated to the various departments and agencies that they 
need to take this seriously. So I would support strongly 
sending that message to all agencies.
    Chairman Leahy. Well, you know, my concern is we know how 
much there are attacks from outside our borders into all our 
different computer banks, and a lot of this has been reported 
in the press, and I will not go into some aspects of it for 
obvious reasons in an open session. So we have to guard against 
that, and we should, of course, for the obvious reasons--
national security and everything else.
    I hate to have to think we have to guard against our own 
people, and yet it seems possible. The Inspector General's 
report included 22 recommendations for improvements in the 
Consular Affairs Bureau of the State Department.
    We have that the Department is going to implement most of 
the recommendations. Is that going to be enough? Again, I am 
thinking about what we do with our own people. It is a whole 
different subject what happens when we have countries, not just 
bad actors outside but actually state-sponsored efforts to 
penetrate our computer systems.
    Mr. Rotenberg. Senator, I think the Inspector General's 
report is helpful, but I don't think it will be enough. It has 
recommendations to the agencies, some of which apparently the 
bureaus are disputing. I think there needs to be here a clear 
mandate about how the practices are going to change so that 
this does not happen in the future. And I think there needs to 
be a comprehensive approach that prevents this from happening 
in other Federal agencies.
    One of the realities right now is that security breaches 
are on the increase in the Federal Government, and without 
adequate safeguards to ensure particularly with private 
contractor access to personal data, I think this problem will 
continue to get worse.
    Mr. Schwartz. Mr. Chairman, I would say that the external 
security and the internal security are actually tied together 
and that you cannot really separate the two. It seems in this 
case, from what we know from the public reports, that the State 
Department did not know all the people that had access to it, 
and did not even list all the agencies that have access to it.
    Chairman Leahy. That really frosted me when I saw that.
    Mr. Schwartz. And then we also see--and I just said from 
other agencies, we know that agencies are losing systems. If 
they do not know where it is, that makes it more vulnerable to 
outside attack. You cannot secure something if you do not know 
where it is.
    These are all systems that have personal information of 
Americans in them, so I think that it is a major concern both 
for the internal threat that comes from this and the external 
threat as well.
    Mr. Raul. One of the critical components, Chairman Leahy, 
in any information security program is the conduct of a risk 
assessment, either incorporated in a Privacy Impact Assessment 
as required by the Federal Government, or in vulnerability 
assessments.
    From my review of the redacted version of the Inspector 
General's report, it is not clear whether the State Department 
had conducted sufficient risk assessments in this area. And it 
sounds like they were not sure who had access, what information 
they had. You know, that is unacceptable because risks, as you 
say, Mr. Chairman, can be either internal or external, and for 
various different motivations. And if an agency does not know 
what is at risk, it cannot possibly protect against it.
    Chairman Leahy. We will stand in recess. I keep looking up 
here. You are probably wondering what I am looking at. It is 
those five lights in the back which went on some time ago. That 
is the 5-minute warning. I am heading to the floor. Take care.
    We will stand in recess.
    [Whereupon, at 11:09 a.m., the Committee was adjourned.]
    [Questions and answers and submissions for the record 
follow.]
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